felhom.eu/documentation/audits/http2shell-2026-10-27

HTTP2Shell (CVE-2026-111497) — 2026-10-27 night, unattended after 22:40 CET

The Brotli decoder bug in Node.js (fixed 22.23.4 / 24.22.1 / 26.12.1; 20, 23, 25 get no fix) and Python brotli (fixed 1.0.10 / 1.1.1 / 1.2.1) / brotlicffi (1.2.1.0). Sources read in the session: the CVE record via security press (Brandefense, Aikido, SOCRadar, Phoenix Security), PYSEC-2026-4322/4323.

What the images carry (read from the registries, scripts/image_runtime.py, no pull)

Checked against the live containers on demo-hp 9201 where one runs: Home Assistant 2026.9.4 Python Brotli 1.2.0 (live: 1.2.0), RomM 5.3.1 Node 24.18.1 (live: v24.18.1), Paperless 2.20.15 Brotli 1.1.0 (live: 1.1.0). The candidates: Home Assistant 2026.10.4 Brotli 1.2.1; RomM 5.4.1 (the newest) still Node 24.18.1; Immich v3.3.5 Node 24.22.1.

The whole catalog (the watch's filling run, --no-mail): 20 catalog apps and one box program carry a bad runtime (R-1332); DooPlex: 19 images to update (HOMELAB-LIST.md, R-1328). Positive controls named: Home Assistant, RomM; negative control audiobookshelf 2.37.2 CURRENT.

Steps (drill only — the live push waits for the operator)

• Home Assistant 2026.9.4 → 2026.10.4, a lane step (09 §3 decision 276): walks/home-assistant/ — proven on 9202 through the guarded Update (135 s), the seeded owner logged in after, soak peak 30.6 % (anon), no kill, no restart; written to the drill (3c8ebb5, superseded step steps/4f987bb4b035eef9.yml).
• Immich v3.2.4 → v3.3.5, a lane step (R-1322): walks/immich/ (see its walk.txt). 9202's old Immich was removed through the product first (its drive folder kept: the drive path could not be resolved — R-442, right).
• Wanderer hidden (D59): drill ee18bff; the live change is wanderer-hidden.patch (not committed to the live catalog at night).
• RomM: no fixed release exists (R-1330). Paperless: decodes only replies to its own outbound calls (R-1331).

Decided by CC unattended (operator may reverse)

Home Assistant as a lane step (decision 276); the runtime cache filled on DooPlex with the stored Docker Hub login instead of a zstd dependency in CI (08 §11); no Paperless step; RomM kept (pick in STATUS); the live catalog changes kept as patches, not commits, at night.